Loading…
Effective date: July 23, 2026
This Addendum is incorporated into customer agreements for the CorpTeam Service. Current subprocessors are listed on our Subprocessor List. Schedule 2 (detailed security measures) is omitted until our SOC 2 program is complete; security obligations in the body of this Addendum still apply.
This Data Processing Addendum (“Addendum”) is incorporated into the Agreement(s) (as defined below) between CorpTeam and Client. This Addendum sets forth the terms and conditions relating to the privacy, confidentiality and security of Personal Information (as defined below) associated with Services to be rendered by CorpTeam to Client pursuant to the Agreement.
“Agreement” means the contract under which CorpTeam has agreed to provide the applicable Services to Client.
“Authorized User” means an employee or contractor of Client who is authorized by Client to access and use the Services on behalf of and for the benefit of Client.
“Client Data” means information provided or made available by Client to CorpTeam for Processing on Client’s behalf to perform the Services. Client Data does not include Service Data.
“Data Subject” means the identified or identifiable natural person to whom Personal Information pertains.
“Personal Information” means Client Data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, that is Processed by CorpTeam in connection with the performance of the Agreement.
“Privacy Laws” means all applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality or security of Personal Information, including without limitation and where applicable, the California Consumer Privacy Act of 2018 and California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq. (collectively, “CCPA”).
“Service Data” means any data relating to the use, support and/or operation of the Services, which is collected by CorpTeam from and/or about Authorized Users of the Services and/or Client’s use of the Services for use for CorpTeam’s own purposes. Service Data may include personal information of Client’s business representatives.
“Services” means the services to be provided under the Agreement.
“Subprocessor” means a third party that CorpTeam engages to Process Personal Information in relation to the Services.
“Aggregate,” “Business Purpose,” “Deidentify,” “Process,” “Processor,” “Sell,” and “Service Provider” have the meaning ascribed to each such term under Privacy Laws.
All capitalized terms used but not defined herein have the meaning ascribed to them in the Agreement.
The parties acknowledge and agree that CorpTeam is acting as a Service Provider to Client with respect to Personal Information.
Subject to applicable Privacy Laws, CorpTeam will Process Personal Information in accordance with Client’s instructions. Unless otherwise agreed to in writing by CorpTeam, the Agreement (including this Addendum) sets out the exclusive and final instructions to CorpTeam for all Processing of Personal Information. The parties acknowledge and agree that the (i) the details of CorpTeam’s Processing of Personal Information are as described in Schedule 1 to this Addendum; and (ii) Personal Information is provided to CorpTeam only for limited and specified Business Purposes.
CorpTeam will ensure that any CorpTeam personnel who Process Personal Information are subject to a duty of confidentiality with respect to the Personal Information.
To the extent the CCPA is applicable to CorpTeam’s Processing of Personal Information, except as described in Section II(F) below or where permitted by applicable law, CorpTeam will not (i) Sell Personal Information or share Personal Information for cross-contextual behavioral advertising purposes; (ii) retain, use or disclose Personal Information (1) for any purpose other than for the Business Purposes specified in Schedule 1 of this Addendum, or (2) outside of the direct business relationship between Client and CorpTeam; or (iii) combine Personal Information received pursuant to the Agreement with Personal Information received from or on behalf of another person(s), or collected from CorpTeam’s own interaction with individuals. CorpTeam certifies that it understands and will comply with the restrictions set forth in clauses (i)-(iii) above. Client may take reasonable and appropriate steps to ensure that CorpTeam uses Personal Information in a manner consistent with Client’s obligations under the CCPA. Client may, upon reasonable notice to CorpTeam and where permitted by the CCPA, take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information.
To the extent required by applicable Privacy Laws, CorpTeam will, taking into account the nature of the Processing of Personal Information and the information available to CorpTeam, reasonably assist Client in fulfilling Client’s obligations under applicable Privacy Laws, including by assisting Client, where appropriate, in responding to Data Subject rights requests pursuant to Privacy Laws and conducting privacy impact assessments related to CorpTeam’s Processing of Personal Information.
To the extent permitted by applicable Privacy Laws, CorpTeam may Process Personal Information obtained in the course of providing the Services: (i) for internal use by CorpTeam to build or improve the quality of its services, provided that CorpTeam does not use the Personal Information to perform services on behalf of another person; (ii) to prevent, detect, or investigate data security incidents or protect against malicious, deceptive, fraudulent or illegal activity; (iii) to comply with applicable laws; (iv) to comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by government authorities; (v) to cooperate with law enforcement agencies concerning conduct or activity that CorpTeam reasonably and in good faith believes may violate federal, state, or local law; and (vi) to exercise or defend legal claims.
CorpTeam may, as part of providing the Services, Deidentify or Aggregate Personal Information in accordance with the standards for such activity set forth in applicable Privacy Laws. For the avoidance of doubt, such Deidentified or Aggregated data, whichever the case may be, will not be subject to the requirements and restrictions set forth in this Addendum. If CorpTeam Deidentifies Personal Information, or receives Deidentified data from Client, CorpTeam must (i) take reasonable measures to ensure that such Deidentified data cannot be associated with an individual or household; (ii) publicly commit to maintain and use the data in Deidentified form and to not attempt to re-identify the data; and (iii) contractually obligate any recipients of the Deidentified data to comply with the terms of this Section II(G) and applicable Privacy Laws.
Upon termination of the Services, and at Client’s written direction, CorpTeam will, to the extent technically possible in the circumstances (as determined in CorpTeam’s sole discretion), either return to Client or delete (or Deidentify) Personal Information within CorpTeam’s possession. Notwithstanding the above, CorpTeam may retain Personal Information where required or permitted by the Agreement (including this Addendum) or applicable law, provided that CorpTeam will continue to protect the privacy, confidentiality and security of such Personal Information in accordance with the terms of this Addendum.
Client will ensure (and is solely responsible for ensuring) that it has given such notices to and obtained such consents and permissions from third parties (including, without limitation, Data Subjects), and has all rights, in each case, as may be required under applicable law or otherwise for CorpTeam to Process Personal Information as contemplated by the Agreement.
Each party will comply with relevant obligations applicable to each party under Privacy Laws and provide the level of privacy protection for Personal Information as is required by applicable Privacy Laws.
To the extent required by applicable Privacy Laws, CorpTeam will notify Client if CorpTeam makes a determination that it can no longer meet its obligations under Privacy Laws.
Where CorpTeam engages a Subprocessor, CorpTeam will enter into a written agreement with the Subprocessor that requires the Subprocessor to comply with obligations that are similar in all material respects to those imposed on CorpTeam under this Addendum.
Information about Subprocessors is available at https://corp.corpteam.ai/legal/subprocessors (“Subprocessor Site”). When CorpTeam engages any new Subprocessor after the effective date of the Agreement, CorpTeam will notify Client of the engagement by updating the Subprocessor Site.
CorpTeam will implement and maintain technical, physical and organizational measures that are appropriate to the risk of the Processing and that are designed to protect the confidentiality, integrity and accessibility of Personal Information (the “Security Measures”). CorpTeam may update the Security Measures from time to time, so long as the updated measures do not materially decrease the overall protection of Personal Information.
Client agrees that Client is solely responsible for its use of the Services, including (1) making appropriate use of the Services to ensure a level of security appropriate to the risk with respect to Personal Information; (2) securing account authentication credentials, systems and devices Client uses to access the Services; (3) securing Client’s systems and devices that CorpTeam uses to provide the Services; and (4) backing up Personal Information. Client has determined that the Services, the Security Measures and CorpTeam’s commitments under this Addendum are adequate to meet Client’s needs, including with respect to any security obligations of Client under Privacy Laws, and provide a level of security appropriate to the risk with respect to the Processing of Personal Information.
CorpTeam will notify Client without undue delay upon becoming aware of unauthorized access to, or acquisition or disclosure of, Personal Information in CorpTeam’s possession that compromises the security, confidentiality or integrity of such Personal Information.
Upon Client’s request, CorpTeam will make available to Client information in its possession necessary to demonstrate CorpTeam’s compliance with its obligations under applicable Privacy Laws and this Addendum.
CorpTeam will arrange for an annual assessment by a qualified independent assessor of CorpTeam’s choosing of CorpTeam’s policies and technical and organizational measures in support of relevant obligations under applicable Privacy Laws using an appropriate and accepted control standard or framework and assessment procedure for such assessment, and provide a report of such assessment to Client upon request.
Client acknowledges that CorpTeam may Process Service Data for its own purposes, as permitted by applicable law, and that CorpTeam independently determines the purposes and means of such Processing. CorpTeam will Process Service Data (i) in compliance with Privacy Laws (if and as applicable in the context); and (ii) as described in CorpTeam’s relevant privacy statements, as updated from time to time.
CorpTeam reserves the right to update this Addendum from time to time to comply with Privacy Laws or applicable contractual obligations, effective upon written notice to Client; provided, however, that no such update will materially diminish the privacy or security of Personal Information.
This Addendum supersedes any prior oral or written agreement, including the Agreement, between the Parties concerning the Processing of Personal Information by CorpTeam as contemplated under this Addendum; in case of any conflict between this Addendum and the Agreement regarding the Processing by Personal Information by CorpTeam, this Addendum will prevail.
Any notices required or permitted to be given by CorpTeam to Client under this Addendum may be given (i) in accordance with any notice clause of the Agreement; (ii) to CorpTeam’s primary points of contact with Client; or (iii) to any email provided by Client for the purpose of providing it with Services-related communications or alerts. Client is solely responsible for ensuring that such email addresses are valid.
THE total aggregate liability of either Party towards the other Party, howsoever arising, under or in connection with this ADDENDUM will under no circumstances exceed any limitations or caps on, and WILL be subject to any exclusions of, liability and loss agreed by the Parties in the Agreement.
This Schedule forms part of the Addendum between Client and CorpTeam.
Nature, purpose and duration of the Processing of Personal Information:
CorpTeam Processes Personal Information on behalf of Client for the purpose of providing the Services under the Agreement, which includes the purposes described in Section II(F) of this Addendum.
For purposes of the CCPA, CorpTeam WILL Process Personal Information for the following Business Purposes: (i) performing the Services on behalf of Client, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying information, providing analytic services, providing storage, or providing similar services on behalf of Client; (ii) helping to ensure security and integrity; (iii) debugging to identify and repair errors that impair existing intended functionality; (iv) short-term, transient use; and (v) undertaking internal research for technological development and demonstration; and (vi) undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by Client, and to improve, upgrade, or enhance such service or device.
The duration of the Processing is equal to the duration of the Agreement plus the period necessary to fulfill the purposes of the Processing and to comply with applicable legal requirements.
The Processing concerns the following categories of Personal Information:
Identifiers and contact information (such as name, business email, job title, and organization); account and authentication credentials; documents, comments, metadata, and workflow records uploaded or generated in the Service; audit, activity, and security logs; e-signature envelope identifiers, signer contact information, and status events from integrated providers; and support and operational communications related to the Service.
List of subcontractors:
CorpTeam has engaged the Subprocessors listed at https://corp.corpteam.ai/legal/subprocessors to assist with Processing Personal Information.
Privacy Policy · Website Terms · Terms of Service · DPA · Subprocessors · Cookie Policy · Cookie preferences · CorpTeam home